chore(deps): update goharbor/registry-photon docker tag to v2.15.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [harbor.alexlebens.net/images/site-profile](https://gitea.alexlebens.dev/alexlebens/site-profile) | minor | `3.12.1` → `3.13.0` |

---

### Release Notes

<details>
<summary>alexlebens/site-profile (harbor.alexlebens.net/images/site-profile)</summary>

### [`v3.13.0`](https://gitea.alexlebens.dev/alexlebens/site-profile/releases/tag/3.13.0)

[Compare Source](https://gitea.alexlebens.dev/alexlebens/site-profile/compare/3.12.1...3.13.0)

##### Bug Fixes

- change execution mode ([a6c889f](a6c889f76a))

##### Features

- add and update pre-commit ([148fe8e](148fe8eeff))
- add fallback ([787479e](787479e077))
- add fallback ([220c29f](220c29f4f7))
- add fallback to run animations on switch ([954112e](954112e30e))
- add semantic-release/npm ([91c9a4b](91c9a4bb91))
- change paths ([9319228](9319228ef6))
- consolidate css into tailwind ([dfeb181](dfeb181a1d))
- downgrade to astro 5 ([f35c73b](f35c73b028))
- move scripts to script folder ([641c7cb](641c7cb33f))
- refactor static paths and photoswipe on blog page, move script to base layout ([93a53ca](93a53cab3d))
- remove react ([e3179b0](e3179b0480))
- revert shiki css changes ([c4104a5](c4104a52d1))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41OS4yIiwidXBkYXRlZEluVmVyIjoiNDMuNTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: #4791
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

clusters/cl01tl/helm/gitea/Chart.lock

@@ -7,7 +7,7 @@ dependencies:
   version: 0.0.3
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.27.0
+  version: 0.28.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
@@ -23,5 +23,5 @@ dependencies:
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:095caf06888cd4663eb5d389399ebad167861007b604016fc4907308474558ab
+digest: sha256:238b7653c9d12c4886a56350b6d66217dbe7ecbb76078a846c7cc2c8cb450eb3
-generated: "2026-03-15T20:05:41.388335307Z"
+generated: "2026-03-16T15:56:55.197735783Z"

clusters/cl01tl/helm/gitea/Chart.yaml

@@ -33,7 +33,7 @@ dependencies:
     repository: https://dl.gitea.com/charts/
     version: 0.0.3
   - name: meilisearch
-    version: 0.27.0
+    version: 0.28.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/harbor/values.yaml

@@ -63,7 +63,7 @@ harbor:
     registry:
       image:
         repository: goharbor/registry-photon
-        tag: v2.14.3
+        tag: v2.15.0
     controller:
       image:
         repository: goharbor/harbor-registryctl

clusters/cl01tl/helm/jellyfin/Chart.lock

@@ -4,9 +4,9 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.27.0
+  version: 0.28.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:ca384647a640ae717ac874a2627f00ac9a1e5c97ff5eeb8f326ebdd471ab1623
+digest: sha256:57b007c6e19dda1300f5025332d9e8104bfb9a50cd7124260bfa68ce2432628b
-generated: "2026-03-09T15:04:08.648165537Z"
+generated: "2026-03-16T15:57:13.466372254Z"

clusters/cl01tl/helm/jellyfin/Chart.yaml

@@ -25,7 +25,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.27.0
+    version: 0.28.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: volsync-target
     alias: volsync-target-config

clusters/cl01tl/helm/karakeep/Chart.lock

@@ -4,12 +4,12 @@ dependencies:
   version: 4.6.2
 - name: meilisearch
   repository: https://meilisearch.github.io/meilisearch-kubernetes
-  version: 0.27.0
+  version: 0.28.0
 - name: cloudflared
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 2.4.0
 - name: volsync-target
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.8.0
-digest: sha256:75f92316d4b6229d00e3dfa39ed5026ad39a28f833321cd3887a2048cdac34c7
+digest: sha256:49e37e17dc859927048c6474ce27cb063a020f291d6d2d24876d0427eddc3656
-generated: "2026-03-09T22:04:48.630821646Z"
+generated: "2026-03-16T15:57:28.156797159Z"

clusters/cl01tl/helm/karakeep/Chart.yaml

@@ -22,7 +22,7 @@ dependencies:
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.6.2
   - name: meilisearch
-    version: 0.27.0
+    version: 0.28.0
     repository: https://meilisearch.github.io/meilisearch-kubernetes
   - name: cloudflared
     repository: oci://harbor.alexlebens.net/helm-charts

clusters/cl01tl/helm/plex/values.yaml

@@ -9,7 +9,7 @@ plex:
         main:
           image:
             repository: ghcr.io/linuxserver/plex
-            tag: 1.43.0@sha256:79dfc89947410ec120a3e34cf68f746f6f154de20772e6f27b9998ca9bd65a5e
+            tag: 1.43.0@sha256:84f8646e799f6636876ab4f283d9fc8f6c51d56098ea74cba82bfb85074b68df
             pullPolicy: IfNotPresent
           env:
             - name: TZ

clusters/cl01tl/helm/site-documentation/values.yaml

@@ -11,7 +11,7 @@ site-documentation:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-documentation
-            tag: 0.2.0
+            tag: 0.3.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/site-profile/values.yaml

@@ -11,7 +11,7 @@ site-profile:
         main:
           image:
             repository: harbor.alexlebens.net/images/site-profile
-            tag: 3.12.1
+            tag: 3.13.0
             pullPolicy: IfNotPresent
           resources:
             requests:

clusters/cl01tl/helm/traefik/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 39.0.5
 - name: traefik-crds
   repository: https://traefik.github.io/charts
-  version: 1.14.0
+  version: 1.15.0
-digest: sha256:8ae6a524708becb7af3a30d2ca4e671c92b7627842f6c6917656526298e2eba5
+digest: sha256:8edf8d2dcabdba2c2b8d6a9508f001ba5ef4bec205423f864b92f2adedd73b60
-generated: "2026-03-09T17:04:21.522089828Z"
+generated: "2026-03-16T15:32:49.364653199Z"

clusters/cl01tl/helm/traefik/Chart.yaml

@@ -18,7 +18,7 @@ dependencies:
     version: 39.0.5
     repository: https://traefik.github.io/charts
   - name: traefik-crds
-    version: 1.14.0
+    version: 1.15.0
     repository: https://traefik.github.io/charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/webp/traefik.webp
 # renovate: datasource=github-releases depName=traefik/traefik

clusters/cl01tl/helm/trivy/values.yaml

@@ -2,6 +2,7 @@ trivy-operator:
   targetWorkloads: "pod,replicaset,replicationcontroller,statefulset,daemonset,cronjob,job"
   operator:
     replicas: 1
+    scanJobsConcurrentLimit: 3
     vulnerabilityScannerEnabled: true
     sbomGenerationEnabled: true
     clusterSbomCacheEnabled: true
@@ -45,3 +46,42 @@ trivy-operator:
           cpu: 200m
           memory: 512Mi
       replicas: 1
+nodeCollector:
+  volumeMounts:
+    - name: var-lib-etcd
+      mountPath: /var/lib/etcd
+      readOnly: true
+    - name: var-lib-kubelet
+      mountPath: /var/lib/kubelet
+      readOnly: true
+    - name: var-lib-kube-scheduler
+      mountPath: /var/lib/kube-scheduler
+      readOnly: true
+    - name: var-lib-kube-controller-manager
+      mountPath: /var/lib/kube-controller-manager
+      readOnly: true
+    - name: etc-kubernetes
+      mountPath: /etc/kubernetes
+      readOnly: true
+    - name: etc-cni-netd
+      mountPath: /etc/cni/net.d/
+      readOnly: true
+  volumes:
+    - name: var-lib-etcd
+      hostPath:
+        path: /var/lib/etcd
+    - name: var-lib-kubelet
+      hostPath:
+        path: /var/lib/kubelet
+    - name: var-lib-kube-scheduler
+      hostPath:
+        path: /var/lib/kube-scheduler
+    - name: var-lib-kube-controller-manager
+      hostPath:
+        path: /var/lib/kube-controller-manager
+    - name: etc-kubernetes
+      hostPath:
+        path: /etc/kubernetes
+    - name: etc-cni-netd
+      hostPath:
+        path: /etc/cni/net.d/

renovate.json

@@ -57,6 +57,9 @@
   "labels": [],
   "prHourlyLimit": 0,
   "prConcurrentLimit": 0,
+  "baseBranchPatterns": [
+    "main"
+  ],
   "packageRules": [
     {
       "description": "Label charts",